Get the latest tech news
XSS on using the legacy "Graphie To PNG" API
An attacker can can upload malicious graphies via (http://graphie-to-png.kasandbox.org/) and (http://graphie-to-png.khanacademy.systems/) that exploit the graphie renderer. The attack targets any page that has a graphie (`khanacademy.org`!!), as well as `cdn.kastatic.org` and `ka-perseus-graphie.s3.amazonaws.com` # Proof of concept ## Step 1: Uploading a malicious graphie consider the...
Or read this on Hacker News
